Team docs accuracy audit: corrections and third-party verification

src/components/NavigationDocs.jsx

@@ -350,12 +350,48 @@ export const docsNavigation = [
                         title: 'Single Sign-On',
                         href: '/manage/team/single-sign-on',
                         isOpen: false,
-                        //                        links: [
-                        //                            { title: 'Authentik', href: '/manage/team/single-sign-on/authentik' },
-                        //                            { title: 'Keycloak', href: '/manage/team/single-sign-on/keycloak' },
-                        //                            { title: 'Auth0', href: '/manage/team/single-sign-on/auth0' },
-                        //                            { title: 'JumpCloud', href: '/manage/team/single-sign-on/jumpcloud' },
-                        //                        ]
+                        links: [
+                            {
+                                title: 'Authentik',
+                                href: '/manage/team/single-sign-on/authentik',
+                            },
+                            {
+                                title: 'Keycloak',
+                                href: '/manage/team/single-sign-on/keycloak',
+                            },
+                            {
+                                title: 'JumpCloud',
+                                href: '/manage/team/single-sign-on/jumpcloud',
+                            },
+                            {
+                                title: 'Auth0',
+                                href: '/manage/team/single-sign-on/auth0',
+                            },
+                            {
+                                title: 'Duo Security',
+                                href: '/manage/team/single-sign-on/duo-security',
+                            },
+                            {
+                                title: 'Zitadel',
+                                href: '/manage/team/single-sign-on/zitadel',
+                            },
+                            {
+                                title: 'cidaas',
+                                href: '/manage/team/single-sign-on/cidaas',
+                            },
+                            {
+                                title: 'AWS Cognito',
+                                href: '/manage/team/single-sign-on/aws-cognito',
+                            },
+                            {
+                                title: 'Zoho',
+                                href: '/manage/team/single-sign-on/zoho',
+                            },
+                            {
+                                title: 'IIJ ID',
+                                href: '/manage/team/single-sign-on/iij-id',
+                            },
+                        ],
                     },
                 ],
             },

src/pages/manage/team/add-users-to-your-network.mdx

@@ -25,36 +25,33 @@ The domains of the private category are the ones that are automatically grouped
 Public domains are the ones of the public email providers like Gmail.
 
 <Note>
-    It might happen (unlikely) that the domain classification system didn't classify your company's domain as private.
-    Our system was unsure about your domain and assigned an unclassified or public category to be on the safe side.
-    Just email us at [hello@netbird.io](mailto:hello@netbird.io) or ping us on [Slack](/slack-url) to fix this.
+    It might happen (unlikely) that the domain classification system didn't classify your company's domain as private. Our system was unsure about your domain and assigned an unclassified or public category to be on the safe side. Just email us at [hello@netbird.io](mailto:hello@netbird.io) or ping us on [Slack](/slack-url) to fix this.
 </Note>
 
 ## Direct user invites
 As the name stands, this way of inviting users is straightforward and works through the web UI.
 To invite a new user, proceed to `Team` then select the `Users` tab and click the <button name="button" className="button-6">Invite User</button> button.
 A window will appear, allowing you to specify the name and email address of the user you want to invite. Optionally, you could select a set of groups with which you want this user to be associated.
 
+On a self-hosted installation the same button reads `Add User`, and it only appears when [local user management](/selfhosted/identity-providers/local) is enabled. If you have [disabled local authentication](/selfhosted/identity-providers/disable-local-authentication), the button is disabled and users have to come from your IdP instead.
+
 The invited users will receive an email invitation that they have to confirm.
 After logging in to the system, they will join your network automatically.
 
 <p>
-    <img src="/docs-static/img/manage/team/user-invites.png" alt="high-level-dia" className="imagewrapper"/>
+    <img src="/docs-static/img/manage/team/user-invites.png" alt="The Invite User dialog with name, email, and group fields" className="imagewrapper"/>
 </p>
 
 <Note>
-    If a user already has a NetBird account, you can't invite them.
-    This is a limitation that is likely to be removed in future versions.
+    If a user already has a NetBird account, you can't invite them. The invite is rejected with `can't invite a user with an existing NetBird account`.
 </Note>
 
 ## Identity Provider (IdP) Sync
 
-NetBird's IdP-Sync automates user access management by integrating with your IdP and automatically
-provisioning users and groups. You can enable this feature from the `Users` tab by clicking the `Identity Provider Sync`
-button.
+NetBird's IdP-Sync automates user access management by integrating with your IdP and automatically provisioning users and groups. You configure it from the `Integrations` page, on the `Identity Provider Sync` tab.
 
 <p>
-    <img src="/docs-static/img/manage/team/idp-sync-reference.png" alt="idp-sync-reference" className="imagewrapper"/>
+    <img src="/docs-static/img/manage/team/idp-sync-reference.png" alt="The Identity Provider Sync tab on the Integrations page" className="imagewrapper"/>
 </p>
 
 See the [Provision Users and Groups From Your Identity Provider](/manage/team/idp-sync) section for more details.

src/pages/manage/team/approve-users.mdx

@@ -1,26 +1,39 @@
 import {Note} from "@/components/mdx";
 
 # Approve users
-The user approval feature enhances security by requiring manual administrator approval before a user can join your NetBird organization via domain matching.
-New NetBird Cloud accounts have user approval enabled by default.
+
+NetBird groups people by email domain. When someone signs up with an address at your company's private domain, they land in your organization automatically, without anyone inviting them. That is [domain matching](/manage/team/add-users-to-your-network#indirect-user-invites), and it is convenient right up until a contractor, a former employee with a lingering mailbox, or anyone who can receive mail at your domain signs up and joins your network.
+
+User approval closes that gap. With it on, a user who arrives through domain matching is held until an administrator approves them. New NetBird Cloud accounts have it enabled by default, and leaving it on is the safer setting.
 
 ## Require user approval
 Navigate to the Dashboard's `Settings` page and the `Authentication` tab and enable or disable `User Approval Required`.
 
-- **Enabled**: Require manual approval for new users joining via domain matching. Users will be blocked until approved. Learn how to approve or reject users in the section [below](#approve-or-reject-user).
-- **Disabled**: Manual approval for new users is not required. Users joining via domain matching will be automatically added to the organization.
+- **Enabled** (recommended): users arriving through domain matching are blocked until an administrator approves them. See [Approve or reject user](#approve-or-reject-user) for what to do with the queue.
+- **Disabled**: anyone who signs up with an email address at your domain joins the organization immediately, with no review.
 
 <p>
-    <img src="/docs-static/img/manage/team/approve-users/netbird-authentication-settings-approval.png" alt="netbird-authentication-settings-approval" className="imagewrapper-big"/>
+    <img src="/docs-static/img/manage/team/approve-users/netbird-authentication-settings-approval.png" alt="The User Approval Required toggle on the Authentication tab of Settings" className="imagewrapper-big"/>
 </p>
 
+## What a pending user sees
+Until an administrator approves them, the user can sign in but can't reach the dashboard. They get a `User Approval Pending` screen telling them their account is pending approval from an administrator. They hold the `Pending` status in the `Users` table until you act on them.
+
 ## Approve or reject user
 To approve a user, navigate to the [Users Page](https://app.netbird.io/team/users) and click the `Approve` or `Reject` button on the right side of the users table.
 
 <p>
-    <img src="/docs-static/img/manage/team/approve-users/netbird-user-approval.png" alt="netbird-user-approval" className="imagewrapper-big"/>
+    <img src="/docs-static/img/manage/team/approve-users/netbird-user-approval.png" alt="Approve and Reject buttons on a pending user row in the Users table" className="imagewrapper-big"/>
 </p>
 
+When several people are waiting, the `Pending Approval` button above the table filters it down to just those users, and carries a badge with the number outstanding. The button only appears while at least one user is waiting.
+
+<Note>
+    `Reject` is permanent. It removes the user from the account and can't be undone. Use `Block` instead if you want to keep the user on the account but deny access.
+</Note>
+
+The `Approve` and `Reject` buttons only render for roles that can update users, which means `Owner` and `Admin`. A `Network Admin` has read-only access to the `Team` tab and won't see them. See [User Roles](/manage/team/user-roles) for the full breakdown.
+
 ## Get started
 <div>
     <Button name="button" className="button-5" onClick={() => window.open("https://netbird.io/pricing")}>Use NetBird</Button>

src/pages/manage/team/auto-offboard-users.mdx

@@ -1,20 +1,17 @@
 # Automatically Offboard Team Members from NetBird
 
-[NetBird's IdP-Sync integration](https://docs.netbird.io/manage/team/idp-sync) simplifies offboarding team members, enhancing
-security and efficiency. With this integration, you can automatically revoke access when users leave the company, when
-temporary access for a freelancer ends after project completion, or when a seasonal employee's contract concludes.
-Likewise, you can use this integration to restrict access to specific resources or environments when a project finishes.
-For instance, you can limit network and resource access when a team member is removed from a group or when an entire group
-is deleted from your Identity Provider.
+Offboarding is where manual user management fails quietly. Someone leaves, their accounts get closed one by one, and the VPN is the one everybody forgets. [IdP-Sync](/manage/team/idp-sync) removes that step: delete the user in your identity provider and NetBird drops them too.
+
+The same applies to narrower changes. Remove someone from a group, or delete the group entirely, and any network access that depended on that group goes with it. That covers a freelancer whose project ended, a seasonal contract running out, or a team member moving off a system they no longer need.
 
 ## Removing Team Members
 
 In this tutorial, we will focus on `user_01`, `user_02`, and `user_03`. From NetBird's `Users` dashboard, you can see
 that `user_01` is part of the `IT Administrators` group, while `user_02` and `user_03` belong to the `Staging` group.
 
-![NetBird Users](/docs-static/img/manage/team/auto-offboard-users/GT3eAeU.png)
+![The NetBird Users table showing the three example users and their groups](/docs-static/img/manage/team/auto-offboard-users/GT3eAeU.png)
 
-To get started, access your Identity Provider (IdP) dashboard. For this example, we'll use [Microsoft Entra ID (Azure AD)](https://docs.netbird.io/manage/team/idp-sync/microsoft-entra-id-sync).
+To get started, access your Identity Provider (IdP) dashboard. For this example, we'll use [Microsoft Entra ID (Azure AD)](/manage/team/idp-sync/microsoft-entra-id-sync).
 
 Next, locate the user you want to offboard in your IdP's user management section. Let’s say you want to revoke access to
 `user_01`, in that case, you will need to select it and click the `Delete` button as shown below.
@@ -25,7 +22,9 @@ After deletion, click the `Refresh` button to confirm that the user is no longer
 
 ![IdP Confirm Deletion](/docs-static/img/manage/team/auto-offboard-users/LJ6QHRV.png)
 
-Wait for the NetBird integration to complete its next synchronization cycle, which usually takes 300 seconds. Alternatively, go to the `Integrations` screen in the NetBird admin console and click the corresponding integration button to manually trigger the synchronization.
+Wait for the NetBird integration to complete its next synchronization cycle, which usually takes 300 seconds. Alternatively, go to `Integrations` in the NetBird dashboard, open the `Identity Provider Sync` tab, and trigger the synchronization manually.
+
+Manual sync is only available for the API-based integrations, Google Workspace and Microsoft Entra ID via API, because NetBird pulls from those providers. SCIM-based integrations such as Okta, JumpCloud, Keycloak, and IIJ ID are push-based: the provider sends changes to NetBird, so there is nothing to trigger from the NetBird side and deprovisioning lands as soon as your IdP pushes it.
 
 ![NetBird Integrations Force Sync](/docs-static/img/manage/team/auto-offboard-users/ogiiUeT.png)
 
@@ -44,7 +43,6 @@ Let's say the current project is finished, and you no longer want members of the
 
 ![IdP Delete Group](/docs-static/img/manage/team/auto-offboard-users/TOZjFKC.png)
 
-Once the changes synchronize in NetBird, users and their group memberships will be updated; therefore,
-[network access associated with that group](https://docs.netbird.io/manage/access-control/manage-network-access) will automatically be revoked.
+Once the changes synchronize in NetBird, users and their group memberships will be updated; therefore, [network access associated with that group](/manage/access-control/manage-network-access) will automatically be revoked.
 
 ![NetBird No Group](/docs-static/img/manage/team/auto-offboard-users/NKabmN6.png)

src/pages/manage/team/entra-id-app-enablement.mdx

@@ -2,29 +2,36 @@ import {Note} from "@/components/mdx";
 
 # Enable NetBird for Microsoft Entra ID
 
-Before your organization can use Microsoft Entra ID features with NetBird — such as user provisioning, group sync, or single sign-on — you need to enable the NetBird enterprise application in your Entra ID tenant and grant admin consent.
+Before your organization can use Microsoft Entra ID features with NetBird, such as user provisioning, group sync, or single sign-on, you need to enable the NetBird enterprise application in your Entra ID tenant and grant admin consent.
 
 ## Prerequisites
 
 - A Microsoft Entra ID tenant
-- An account with **Global Administrator** or **Cloud Application Administrator** role
+- An account with the **Privileged Role Administrator** or **Global Administrator** role
+
+<Note>
+    **Cloud Application Administrator may not be enough.** Microsoft allows that role to grant consent for any API *except* Microsoft Graph application permissions. NetBird's provisioning and group sync read directory data through Microsoft Graph, so if the consent screen lists Graph application permissions, the grant has to come from a **Privileged Role Administrator** or a **Global Administrator**.
+</Note>
 
 ## Step 1: Find the NetBird Enterprise Application
 
-1. Sign in to the [Azure portal](https://portal.azure.com)
-2. Navigate to **Home** → **Microsoft Entra ID** → **Enterprise Applications**
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com)
+2. Navigate to **Entra ID** → **Enterprise apps** → **All applications**
 3. Search for the application with Application ID: `7a7538de-b7ed-4e49-befe-edbe74d5e0a1`
 4. Select the **NetBird** application from the results
 
+You can reach the same blade from the [Azure portal](https://portal.azure.com) under
+**Microsoft Entra ID** → **Enterprise applications**.
+
 <p>
     <img src="/docs-static/img/manage/team/entra-id-app-enablement/enterprise-applications.png" alt="Find NetBird in Enterprise Applications" className="imagewrapper-big"/>
 </p>
 
 ## Step 2: Grant Admin Consent
 
-1. In the NetBird application overview, click **Permissions** in the left menu
-2. Click **Grant admin consent for Default Directory**
-3. Review the requested permissions and confirm
+1. In the NetBird application overview, select **Permissions** under **Security**
+2. Review the requested permissions carefully, then click **Grant admin consent for `<your tenant name>`**
+3. Confirm the consent prompt
 
 <p>
     <img src="/docs-static/img/manage/team/entra-id-app-enablement/grant-admin-consent.png" alt="Grant admin consent for NetBird" className="imagewrapper-big"/>

src/pages/manage/team/idp-sync/embedded/keycloak-sync.mdx

@@ -2,17 +2,12 @@ import {Note} from "@/components/mdx";
 
 # Provision Users and Groups From Keycloak (Embedded IdP)
 
-Keycloak is an open-source identity and access management solution that provides features like single sign-on (SSO),
-multi-factor authentication (MFA), user federation, and centralized identity management to help organizations
-secure and manage access to their applications and resources.
+Keycloak is an open source identity and access management solution that provides features like single sign-on (SSO), multi-factor authentication (MFA), user federation, and centralized identity management to help organizations secure and manage access to their applications and resources.
 
-NetBird's Keycloak integration enhances user management by allowing you to utilize Keycloak as your identity provider.
-This integration automates user authentication in your network, adds SSO and MFA support, and simplifies network access management
-to your applications and resources.
+Connecting Keycloak to NetBird lets your existing Keycloak users and groups drive network access. Users sign in with the credentials they already have, including any MFA you enforce in Keycloak, and group membership flows into NetBird so your access policies follow it.
 
 <Note>
-    Before creating this integration, ensure you have a Keycloak connector configured in your embedded IdP.
-    If not, refer to the [Identity Providers](/selfhosted/identity-providers/keycloak) documentation to set it up.
+    Before creating this integration, ensure you have a Keycloak connector configured in your embedded IdP. If not, refer to the [Identity Providers](/selfhosted/identity-providers/keycloak) documentation to set it up.
 </Note>
 
 ## Prerequisites
@@ -33,7 +28,7 @@ To enable SCIM synchronization in NetBird, navigate to `Integrations > Identity
 Select your **Keycloak** identity provider connector for this integration and click **Continue** to proceed.
 
 <p>
-    <img src="/docs-static/img/manage/team/idp-sync/keycloak-sync/select-idp.png" alt="select-identity-provider" className="imagewrapper-big"/>
+    <img src="/docs-static/img/manage/team/idp-sync/keycloak-sync/select-idp.png" alt="The connector picker with the Keycloak identity provider selected" className="imagewrapper-big"/>
 </p>
 
 This will open a pop-up window featuring a user-friendly wizard to guide you through the configuration process.
@@ -200,8 +195,7 @@ After completing the initial sync, you can verify that users and groups have bee
 ![NetBird Verify Users](/docs-static/img/manage/team/idp-sync/keycloak-sync/netbird-verify-users.png)
 
 <Note>
-    SCIM provisioning will manage only resources that are created through Keycloak. Any resources created directly in
-    NetBird will not be managed by SCIM.
+    SCIM provisioning will manage only resources that are created through Keycloak. Any resources created directly in NetBird will not be managed by SCIM.
 </Note>
 
 <Note>